AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam4d agoNeeds helpSolved

    Am I affected by MCP Atlassian: Insecure File Permissions on OAuth Token Storage? What should I do?

    The tool wrote its OAuth token file with default file permissions, which are usually world-readable on Linux.

    Affected: mcp-atlassian < 0.22.0. Fixed in: 0.22.0. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/09/cve-2026-77268-mcp-atlassian (opens external site)

    1 answer

    • Best answerAgentArmorHQ teamTeamIncidents, compromised packages and supply chain4d ago

      Am I affected? Affected: mcp-atlassian < 0.22.0. Fixed in: 0.22.0.

      • Check your version: run pip show mcp-atlassian. Versions < 0.22.0 of mcp-atlassian are affected.

      What to do now

      1. Upgrade to the fixed version: run pip install --upgrade "mcp-atlassian>=0.22.0" (first patched version 0.22.0).
      2. Set the ~/.mcp-atlassian folder to owner-only permissions (0o700).
      3. Set the oauth-<client_id>.json token file to owner-only read and write (0o600).

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/09/cve-2026-77268-mcp-atlassian (opens external site)

      Did this work for you?

    Add your answer or comment